Terraform创建Azure应用网关嵌套动态块条件匹配问题

场景说明 #

使用Terraform创建Azure应用网关，通过url_maps定义带唯一前端端口的监听器，services定义对应后端配置和路径规则，每个url map关联多个后端池、设置及路径。

本地变量定义 #

locals {
  url_maps = [
    {
      "name"          = "service1"
      "frontend_port" = 10000
      "protocol"      = "https"
    },
    {
      "name"          = "service2"
      "frontend_port" = 20000
      "protocol"      = "https"
    }
  ]

  services = [
    {
      "frontend_port" = 10000
      "name" = "one-service1"
      "paths" = "/service1/one/*"
    },
    {
      "frontend_port" = 10000
      "name" = "two-service1"
      "paths" = "/service1/two/*"
    },
    {
      "frontend_port" = 20000
      "name" = "one-service2"
      "paths" = "/service2/one/*"
    },
    {
      "frontend_port" = 20000
      "name" = "two-service2"
      "paths" = "/service2/two/*"
    },
  ]
}

初始代码问题 #

编写动态块配置url_path_map时，嵌套的path_rule动态块触发必填项错误：At least 1 "path_rule" blocks are required。直接指定端口号时逻辑正常，但使用url_path_map.value.frontend_port做条件比较时失败，尽管该值能返回正确端口。

初始代码片段：

dynamic "url_path_map" {
  for_each = var.url_maps
  content {
    default_redirect_configuration_name = "default"

    name = "${url_path_map.value.frontend_port}-${url_path_map.value.protocol}-url-path-map"
    dynamic "path_rule" {
      for_each = [ 
        for s in var.services : s
        ### 如下条件比较时触发错误...
        ### "At least 1 "path_rule" blocks are required."
        # if s.frontend_port == url_path_map.value.frontend_port

        ### 直接指定端口号时，条件语句可正常工作
        ### 但此时该端口关联的所有路径会被添加到url map中
        if s.frontend_port == 20000
      ]
      content {
        name                       = path_rule.value.name
        backend_address_pool_name  = path_rule.value.name
        backend_http_settings_name = path_rule.value.name
        paths                      = [path_rule.value.paths]
      }
    }
  }
}

解决方案 #

问题根源是字符串与数字类型不匹配，将url_path_map.value.frontend_port转换为数字类型后，条件比较正常执行，path_rule块能正确生成。修正后的代码片段：

dynamic "path_rule" {
  for_each = [ 
    for s in var.services : s
    if s.frontend_port == tonumber(url_path_map.value.frontend_port)
  ]
  content {
    name                       = path_rule.value.name
    backend_address_pool_name  = path_rule.value.name
    backend_http_settings_name = path_rule.value.name
    paths                      = [path_rule.value.paths]
  }
}

优化建议 #

建议将路径匹配逻辑从应用网关资源块中移至本地变量中定义，提升代码可读性与问题排查效率。

内容的提问来源于stack exchange，提问作者andre